[BUG] Fonts not loading due to Content Security Policy

[Goldfels]

When loading a board, the fonts on the board do not get loaded, and I see a lot of error messages in the brower's console, such as:

Content-Security-Policy: The page’s settings blocked the loading of a resource (font-src) at https://esm.sh/@nextcloud/excalidraw@0.18.0-6135eb0/dist/prod/fonts/Excalifont/Excalifont-Regular-a88b72a24fb54c9f94e3b5fdaa7481c9.woff2 because it violates the following directive: “font-src 'self' data:”

I suspect this is a bug introduced by #1196 which removed the line $policy->addAllowedFontDomain('*'); causing fonts to no longer be loaded.

Tested Whiteboard version 1.5.8, on Nextcloud version 33.0.3.2, with a brand new, empty installation.

[QuinsZouls]

I can confirm this issue, I have to disable manually the CSP restrictions using a extension in order to have the fonts loading:
https://webextension.org/listing/csp-unblock.html

[zonque]

The CSP error is preceded by a 404 trying to load the font from the NC server itself. I would actually much prefer not to fetch it from an external entity, so that 404 is what should be fixed. Do other see this pattern as well?

[Goldfels]

@zonque Now that I checked, I see those 404s as well. So I tracked down the root cause, and made PR #1245 for it

[zonque]

So there are two bugs then:

1. the load path for the font file is wrong (leading to the 404)
2. esm.sh is used as fallback, but the CSP policy does not allow that source